This policy explains how AdFlow handles personal data in the mobile app and on adflow.tradik.dev. Items in [square brackets] are placeholders to be completed before launch. If translations differ, the English version applies.

1. Who we are

AdFlow is operated by Infivista (infivistacloud.com), [registered legal name, company number and registered address]. Infivista is the controller under UK GDPR and EU GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Privacy contact: privacy@adflow.tradik.dev
Grievance Officer (India, IT Rules 2021 and DPDP Act): [name, designation, address — to be appointed]
EU representative (Art. 27 GDPR): [to be appointed if required]
UK representative (Art. 27 UK GDPR): [to be appointed if required]

2. What we collect and why

Data	Why	Legal basis (UK/EU GDPR)
Google account name, email address and account ID (from Google Sign-In)	Create and secure your account	Contract
Photos you upload (up to 3 per ad), title, description, price, offer label and options	Make your video	Contract
Voice recordings, if you dictate an ad	Turn speech into an ad draft; the audio is deleted after processing	Contract
Business profile and logo, if you add them	Show your business name and logo in videos	Contract
Generated videos, scripts and voiceovers	Deliver the video to you and publish it when you ask	Contract
Facebook Page and Instagram account IDs and an access token	Publish to your Page and Reels when you tap “publish”; the token is encrypted at rest	Contract / consent (you can disconnect any time)
Moderation results for your photos, text and videos	Prevent illegal or harmful content and keep an audit trail	Legitimate interests; legal obligation
Technical data: IP address, device language, app version, request logs	Security, rate limiting, fixing errors	Legitimate interests
Billing: plan, billing country, invoices and payment status (card details are handled by Stripe, we never see the full card number)	Take payment, issue GST/VAT invoices, keep accounting records	Contract; legal obligation (tax law)
Website: analytics through Google Tag Manager	Understand how the site is used	Consent (see the cookie policy)

Under the DPDP Act we process your personal data for the purposes above on the basis of your consent or for legitimate uses permitted by the Act. We do not sell personal data and do not use your photos to train AI models.

We remove hidden metadata such as GPS location from your photos when they are uploaded.

3. Who processes your data

We use service providers that act on our instructions:

Google — sign-in; fonts on the website; Google Tag Manager (only after consent).
OpenAI — moderation of photos and text, script writing, speech-to-text and voiceover. Data is sent through the API and, according to OpenAI's API terms, not used to train their models [confirm retention settings].
Stripe — card payments, subscriptions and tax invoices.
Cloudflare — DNS, network security, website hosting (Cloudflare Pages) and secure tunnel to our servers.
Meta Platforms — only when you connect Facebook/Instagram and publish.
Hosting providers for our servers and storage: [provider names and locations].

Video rendering runs on computers operated by Infivista.

4. International transfers

Our providers may process data outside your country, including in the United States and the EU. For transfers from the UK or EU we rely on adequacy regulations, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum. Transfers from India follow the DPDP Act and any restrictions notified under it.

5. How long we keep data

Photos, generated videos and ad details: until you delete the ad or your account [confirm: maximum retention, e.g. auto-delete after N days].
Rejected uploads: [N] days, for moderation audit.
Voice recordings: deleted after processing.
Meta access token: until you disconnect Facebook or delete your account.
Account data: until you delete your account; backups are overwritten within [30] days.
Server logs: [30] days.

6. Your rights

UK and EU (UK GDPR / GDPR): access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your EU supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

India (DPDP Act 2023): access to a summary of your data, correction and erasure, grievance redressal through our Grievance Officer, and nominating another person to exercise your rights. If we do not resolve your grievance you may approach the Data Protection Board of India.

To use any right, email privacy@adflow.tradik.dev from the address linked to your account. We reply within one month (UK/EU) or the period prescribed under the DPDP Rules. Deleting data: see data deletion.

7. Children

AdFlow is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data.

8. Security

Encrypted connections (HTTPS), private storage for photos until they pass moderation, short-lived access links, encrypted Meta tokens, access restricted to staff who need it.

9. Changes

We will post changes here and tell you in the app about important ones.

Privacy policy